Lots of shitcomments here, but in theory I agree use Linux. Lol but thats not an option for all tools poorly so:

• enable everything apart freakin browser scanning or cloud based “security” in the security settings. Also this code execution protection and all that.
• do security updates
• use a non admin account I guess? Clicking on ‘okay’ is not a security measurement??
• only install software from very trusted sources. Poorly I havent got chocolatey to run, thats the only good one. The MS store sucks
• debloat as many apps as possible as they are not needed

The default firewall is secure, but you may want to improve privacy by using Portmaster. SimpleWall always launches a few seconds after system boot and I need to accept it, so I dont trust its capabilities really.

You may want to disable this .exe scanning before installation, as its pure tracking, but this will reduce security.

On Windows all main apps have their own updaters as there is no working package management. This is crazy, as all apps need internet access, but well.

Microsoft store apps poorly cant really be recommended. Avoid rootkits like Adobe suite, ArcGIS Pro, weird games etc. Even if they are in that store they will just have an installer there and plant themselves into your system like crazy. Also afaik all browsers in that store are using Edge Webview, like on iOS.

Remove as much as you can, use BulkCrapUninstaller for that. Edge can be completely purged by plugging the disk into a linux machine and deleting its exe under something like C:/Programs/…